Security audit

Media Processor

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a legitimate media-processing skill, but it needs review because its file-writing behavior can overwrite local files without clear safeguards.

Review this before installing if you may run it on valuable media directories or shared workspaces. Use explicit output folders, avoid pointing outputs at existing files, and prefer a version that refuses to overwrite unless requested, uses secure temporary files, and pins reviewed dependency versions.

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (16)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 85% confidence
Finding: The skill advertises and demonstrates capabilities that imply shell execution and file writing (for example invoking ffmpeg and producing output files), but it does not declare any permissions. Undeclared powerful capabilities reduce transparency and can lead to unsafe execution assumptions by users or platforms, especially in a media-processing skill that handles arbitrary file paths and external tools.

Missing User Warnings

Medium

Confidence: 81% confidence
Finding: The conversion routine always supplies -y, causing FFmpeg to overwrite the destination file without confirmation. If output_path is influenced by user input or automation mistakes, existing files can be silently destroyed or replaced, which is especially risky in enterprise media workflows handling valuable assets.

Missing User Warnings

Medium

Confidence: 82% confidence
Finding: Audio extraction also forces overwrite of the target file via -y, enabling silent destruction of preexisting content. In a batch-processing or agent-driven context, a mistaken or attacker-controlled output path could replace important files without any warning.

Missing User Warnings

Medium

Confidence: 82% confidence
Finding: The compression function overwrites destination files unconditionally, creating a clear integrity risk. Because this skill is designed for automated multimedia processing, unattended execution makes accidental or malicious file replacement more dangerous than in an interactive CLI tool.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: This merge operation has two real issues: it forces overwrite of output_path and it uses a fixed temporary filename temp_video_list.txt in the current working directory. The predictable temp file can be clobbered, raced, or redirected via symlink in shared environments, potentially causing unintended file modification or misuse of concatenation input.

Unpinned Dependencies

Low

Category: Supply Chain
Content: moviepy>=1.0.3 pydub>=0.25.1 librosa>=0.10.0 openai-whisper>=20231117
Confidence: 93% confidence
Finding: The dependency is specified with only a lower bound, so future installs may pull in unreviewed major or minor releases with breaking changes or newly introduced malicious behavior. In a media-processing skill that handles complex third-party codecs and parsers, uncontrolled dependency drift increases supply-chain risk and makes builds non-reproducible.

Unpinned Dependencies

Low

Category: Supply Chain
Content: moviepy>=1.0.3 pydub>=0.25.1 librosa>=0.10.0 openai-whisper>=20231117 numpy>=1.24.0
Confidence: 93% confidence
Finding: Using an unpinned version for pydub allows installation of any newer release, which can introduce unexpected behavior, regressions, or supply-chain compromise without code changes in this project. For audio-processing software, reproducibility is important because parsing libraries often interact with external tools and untrusted media.

Unpinned Dependencies

Low

Category: Supply Chain
Content: moviepy>=1.0.3 pydub>=0.25.1 librosa>=0.10.0 openai-whisper>=20231117 numpy>=1.24.0 Pillow>=10.0.0
Confidence: 93% confidence
Finding: A lower-bound-only specifier for librosa permits uncontrolled upgrades, which is a supply-chain and stability risk. In a multimedia context, parser-heavy libraries are exposed to attacker-controlled files, so silently changing versions can affect security posture.

Unpinned Dependencies

Low

Category: Supply Chain
Content: moviepy>=1.0.3 pydub>=0.25.1 librosa>=0.10.0 openai-whisper>=20231117 numpy>=1.24.0 Pillow>=10.0.0 ffmpeg-python>=0.2.0
Confidence: 92% confidence
Finding: openai-whisper is not pinned, so installations are not reproducible and may unexpectedly pull newer code with different dependencies or behaviors. This raises supply-chain risk, especially for a skill that may process externally supplied audio content in automated environments.

Unpinned Dependencies

Low

Category: Supply Chain
Content: pydub>=0.25.1 librosa>=0.10.0 openai-whisper>=20231117 numpy>=1.24.0 Pillow>=10.0.0 ffmpeg-python>=0.2.0 srt>=3.5.0
Confidence: 94% confidence
Finding: numpy is specified with a minimum version only, which allows any later release to be installed and undermines reproducibility. Given numpy's central role in the processing stack, unexpected upgrades can propagate security and compatibility issues across the whole skill.

Unpinned Dependencies

Low

Category: Supply Chain
Content: librosa>=0.10.0 openai-whisper>=20231117 numpy>=1.24.0 Pillow>=10.0.0 ffmpeg-python>=0.2.0 srt>=3.5.0 tqdm>=4.66.0
Confidence: 94% confidence
Finding: Pillow is unpinned, so future installations may receive versions with new vulnerabilities, API changes, or altered decoding behavior. Because Pillow processes potentially attacker-controlled image data, uncontrolled upgrades are particularly undesirable in a media-processing skill.

Unpinned Dependencies

Low

Category: Supply Chain
Content: openai-whisper>=20231117 numpy>=1.24.0 Pillow>=10.0.0 ffmpeg-python>=0.2.0 srt>=3.5.0 tqdm>=4.66.0
Confidence: 92% confidence
Finding: ffmpeg-python is declared with only a minimum version, allowing unreviewed future versions to be fetched during installation. Since it orchestrates multimedia processing workflows, dependency drift can change command construction behavior and enlarge the attack surface.

Unpinned Dependencies

Low

Category: Supply Chain
Content: numpy>=1.24.0 Pillow>=10.0.0 ffmpeg-python>=0.2.0 srt>=3.5.0 tqdm>=4.66.0
Confidence: 90% confidence
Finding: The srt package is unpinned, which creates non-deterministic builds and unnecessary supply-chain exposure. Subtitle parsers may handle externally provided text files, so allowing uncontrolled version changes can alter security characteristics over time.

Unpinned Dependencies

Low

Category: Supply Chain
Content: Pillow>=10.0.0 ffmpeg-python>=0.2.0 srt>=3.5.0 tqdm>=4.66.0
Confidence: 93% confidence
Finding: tqdm is unpinned, so installations may unexpectedly pull a later version that changes runtime or CLI-related behavior. Even utility packages can become entry points for supply-chain compromise if versions are not controlled.

Known Vulnerable Dependency: Pillow — 10 advisory(ies): CVE-2016-2533 (Pillow buffer overflow in ImagingPcdDecode); CVE-2023-50447 (Arbitrary Code Execution in Pillow); CVE-2021-27922 (Pillow Uncontrolled Resource Consumption) +7 more

Critical

Category: Supply Chain
Confidence: 88% confidence
Finding: Pillow has a history of serious issues affecting image parsing, including resource exhaustion and, in some versions, code execution or memory corruption. In a media-processing skill that is likely to ingest untrusted images or video frames, an exposed vulnerable Pillow version could lead to denial of service or potentially code execution depending on the exact deployed release.

Known Vulnerable Dependency: tqdm — 3 advisory(ies): CVE-2024-34062 (tqdm CLI arguments injection attack); CVE-2016-10075 (TDQM Arbitrary Code Execution); CVE-2016-10075 (The tqdm._version module in tqdm versions 4.4.1 and 4.10 allows local users to e)

High

Category: Supply Chain
Confidence: 81% confidence
Finding: tqdm has reported issues including CLI argument injection in certain usage patterns, and this package is not pinned to a safe version. While tqdm is often low-risk in normal library use, a multimedia toolchain may invoke helper scripts or CLI workflows where vulnerable versions could be abused, making this a credible dependency risk until the exact resolved version and usage are verified.

Static analysis

No suspicious patterns detected.